---
title: "Authentication"
description: "Authenticate with the Edge REST API using API keys: create and revoke keys, send them as Bearer tokens, manage them via the API, and when to use agent codes."
url: "https://edge.network/docs/api/authentication"
section: "REST API"
---

# Authentication

Every request to the REST API is authenticated with an API key passed as a Bearer token.

## Creating an API key

1. Go to [Account → API Keys](/console/api-keys) in the console.
2. Click **Create API Key**.
3. Give it a descriptive name (e.g. "Deploy pipeline (production)").
4. Copy the key immediately. It is shown only once and stored hashed.

Keys start with `ek_live_` and can be created with an optional expiry (30 days, 90 days, 1 year or never). Keys can be revoked at any time; revocation takes effect immediately.

> [!WARNING]
> **Keys are account-wide.** An API key carries full access to the account that created it, so treat it like a password. Never commit keys to version control, and prefer one key per integration so individual keys can be revoked without breaking everything else.

## Making authenticated requests

Pass the key in the `Authorization` header:

```bash
curl https://edge.network/api/compute/vms \
  -H "Authorization: Bearer ek_live_abc123def456..."
```

A missing, malformed, revoked or expired key returns `401`:

```http
HTTP/1.1 401 Unauthorized

{
  "error": "Invalid or expired API key",
  "code": "AUTHENTICATION_ERROR"
}
```

## Managing keys via the API

API keys can themselves be managed programmatically (using an existing key or console session):

| Endpoint | Description |
|---|---|
| `GET /api/account/keys` | List keys. Returns name, prefix, last-used and expiry (never the secret). |
| `POST /api/account/keys` | Create a key. Body: `{ name, expiresIn? }`, where `expiresIn` is e.g. `30d`, `90d`, `1y` or `never`. The full secret is returned once. |
| `PATCH /api/account/keys/:keyId` | Rename a key |
| `DELETE /api/account/keys/:keyId` | Revoke a key immediately |

## Narrower access for agents and tools

API keys are all-or-nothing. If you're granting access to an AI agent or third-party tool and want per-product permissions and spending caps, use an [agent access code](/docs/agent/access-codes) (`ea_live_...`) with the [Agent API](/docs/agent) instead.

| Credential | Prefix | Scope | Used with |
|---|---|---|---|
| API key | `ek_live_` | Full account access | REST API (`/api/*`), CLI |
| Agent access code | `ea_live_` | Per-product permissions, budget caps | Agent API (`/agent/*`) |